Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
On a server's authorized_keys file, an ssh key is preceded by a specific command to prevent users to run any other command:
command="/bin/restricted_shell" ssh-rsa AAA....
It is often recommended to add the no-X11-forwarding restriction when using command.
As the restriction is not present - and X11Forwarding is allowed - is it possible to execute for instance an xterm session instead of the restricted command?
As the restriction is not present - and X11Forwarding is allowed - is it possible to execute for instance an xterm session instead of the restricted command?
No, it's not possible.
But, unless the forced command specified needs itself an X11 display, there's no reason to allow the X11 forwarding: when X11 forwarding is enabled, ssh will run the xauth command on the server, which will create/modify an .Xauthority file in the user's directory, so an innocuous entry like command="uptime" ssh-rsa ... in the authorized keys file suddenly becomes a lot more interesting, and somebody may leverage it in creative ways.
Notice that you can disable X11 forwarding on a per-key basis in the authorized keys file:
command="uptime",no-x11-forwarding ssh-rsa AAA...